Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 07:16
Static task
static1
Behavioral task
behavioral1
Sample
15012021567.exe
Resource
win7v20201028
General
-
Target
15012021567.exe
-
Size
782KB
-
MD5
0377728dc176c34ec287a4ee6e1b6800
-
SHA1
e5d67a362ae9c51449000987f42882fba4d402df
-
SHA256
fb1b538251b7c9a011807fee199f1446b68c40e9caed0709389eac91e311bf1e
-
SHA512
3c8a2c442c16bdf1a540dec60305d7f663b444676d9fe5064ddae4ca5b0aeee41d111771ccae554cb70977ee8e066b6c21f0d32ed7ce765287d6a64896b4753b
Malware Config
Extracted
formbook
http://www.southsideflooringcreations.com/dkk/
goldenfarmm.com
miproper.com
theutahan.com
efeteenerji.com
wellfarehealth.com
setricoo.com
enjoyablephotobooths.com
semaindustrial.com
jennywet.com
jackhughesart.com
cantgetryte.com
searko.com
zxrxhuny.icu
exoticorganicwine.com
fordexplorerproblems.com
locationwebtv.net
elinvoimainenperhe.com
mundoclik.com
nouvellenormale.com
talasnakliyat.com
mundusabsurdus.com
leathercustomgrips.com
5523.xyz
aaabizmedia.com
sandrasantoss.com
sellitech.net
pangeleia.com
risepasal.com
ruidev.site
blogthatanswer.com
cormacknnl.com
coolfishartist.com
jessicaasiankitchen.com
hinikerco.com
dragonflyaerialimagery.net
dhtmlkits.com
miacella.com
mvipfb.com
108-bet.com
lancru-baikyaku.xyz
hkgerry.com
solarpanelsgreenenergy.com
traditionalcookingacademy.com
freecarandhome.com
naturacake.com
dreambuildarchitect.com
ortigiarealty.com
datings.life
willtecint.com
newlife-here.com
850712.com
fallguysskin.com
portaldoctortv.com
nocodehosting.com
ornhealthcare.com
amkuyidl.icu
trinewstyles.com
rabninco.com
trapusaapparel.com
mystiquerubirosarum.com
xn--mundocao-j3a.com
226basketball.com
goodj.online
congratulationsbanner.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1336-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1336-12-0x000000000041EC00-mapping.dmp formbook behavioral2/memory/2208-14-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
15012021567.exe15012021567.exeNETSTAT.EXEdescription pid process target process PID 1140 set thread context of 1336 1140 15012021567.exe 15012021567.exe PID 1336 set thread context of 3012 1336 15012021567.exe Explorer.EXE PID 1336 set thread context of 3012 1336 15012021567.exe Explorer.EXE PID 2208 set thread context of 3012 2208 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2208 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
15012021567.exeNETSTAT.EXEpid process 1336 15012021567.exe 1336 15012021567.exe 1336 15012021567.exe 1336 15012021567.exe 1336 15012021567.exe 1336 15012021567.exe 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE 2208 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
15012021567.exeNETSTAT.EXEpid process 1336 15012021567.exe 1336 15012021567.exe 1336 15012021567.exe 1336 15012021567.exe 2208 NETSTAT.EXE 2208 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
15012021567.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1336 15012021567.exe Token: SeDebugPrivilege 2208 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
15012021567.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1140 wrote to memory of 1336 1140 15012021567.exe 15012021567.exe PID 1140 wrote to memory of 1336 1140 15012021567.exe 15012021567.exe PID 1140 wrote to memory of 1336 1140 15012021567.exe 15012021567.exe PID 1140 wrote to memory of 1336 1140 15012021567.exe 15012021567.exe PID 1140 wrote to memory of 1336 1140 15012021567.exe 15012021567.exe PID 1140 wrote to memory of 1336 1140 15012021567.exe 15012021567.exe PID 3012 wrote to memory of 2208 3012 Explorer.EXE NETSTAT.EXE PID 3012 wrote to memory of 2208 3012 Explorer.EXE NETSTAT.EXE PID 3012 wrote to memory of 2208 3012 Explorer.EXE NETSTAT.EXE PID 2208 wrote to memory of 1344 2208 NETSTAT.EXE cmd.exe PID 2208 wrote to memory of 1344 2208 NETSTAT.EXE cmd.exe PID 2208 wrote to memory of 1344 2208 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15012021567.exe"C:\Users\Admin\AppData\Local\Temp\15012021567.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15012021567.exe"C:\Users\Admin\AppData\Local\Temp\15012021567.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\15012021567.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1140-2-0x0000000073A30000-0x000000007411E000-memory.dmpFilesize
6.9MB
-
memory/1140-3-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/1140-5-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/1140-6-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/1140-7-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/1140-8-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/1140-9-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/1140-10-0x0000000005AE0000-0x0000000005B4A000-memory.dmpFilesize
424KB
-
memory/1336-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1336-12-0x000000000041EC00-mapping.dmp
-
memory/1344-17-0x0000000000000000-mapping.dmp
-
memory/2208-14-0x0000000000000000-mapping.dmp
-
memory/2208-15-0x00000000001A0000-0x00000000001AB000-memory.dmpFilesize
44KB
-
memory/2208-16-0x00000000001A0000-0x00000000001AB000-memory.dmpFilesize
44KB
-
memory/2208-18-0x0000000003CB0000-0x0000000003E41000-memory.dmpFilesize
1.6MB
-
memory/3012-19-0x0000000006180000-0x00000000062A7000-memory.dmpFilesize
1.2MB